Hard-coded AWS IAM Credentials Vulnerability in Koollab LMS
CVE-2026-63239

5.4MEDIUM

Key Information:

Vendor

Three Learning

Status
Koollab Lms
Vendor
CVE Published:
29 July 2026

What is CVE-2026-63239?

A vulnerability in Koollab LMS involves hard-coded AWS IAM credentials that allow unauthorized access to shared multi-tenant S3 buckets and SQS queues. This flaw exposes sensitive data and gives attackers the ability to inject malicious content, manipulate job processes, or intercept emails, potentially jeopardizing the security of user data and operations.

Affected Version(s)

Koollab LMS 5.3.2

References

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-20...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.